Re: generating a session id
From: Joe Smith (joe_at_inwap.com)
Date: 12/23/04
- Next message: bill: "How to redirect my $fh to STDOUT?"
- Previous message: Joe Smith: "Re: generating a session id"
- In reply to: ioneabu_at_yahoo.com: "Re: generating a session id"
- Next in thread: A. Sinan Unur: "Re: generating a session id"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Wed, 22 Dec 2004 18:08:31 -0800
ioneabu@yahoo.com wrote:
> I have made an effort to understand a process by exploring it in its
> most basic form, as if I had to create for the first time. Of course
> my simple minded code is not as good as the real thing, but why?
When I connect to your server and get a session ID using your algorithm,
with not too much effort I can determine the current seed of your rand()
function. With that knowledge, I could predict what the next session ID
is going to be, and start hijacking your customer's sessions.
Your method has insufficent entropy and is not of cryptographic quality.
-Joe
- Next message: bill: "How to redirect my $fh to STDOUT?"
- Previous message: Joe Smith: "Re: generating a session id"
- In reply to: ioneabu_at_yahoo.com: "Re: generating a session id"
- Next in thread: A. Sinan Unur: "Re: generating a session id"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
|
